Strawberry GraphQL, a library for building GraphQL APIs, is vulnerable to an authentication bypass on WebSocket subscription endpoints in versions before 0.312.3. The legacy graphql-ws subprotocol handler does not enforce the completion of the connection_init handshake before processing start messages, allowing an attacker to skip the on_ws_connect authentication hook entirely. This vulnerability is classified under CWE-306 and has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The issue is fixed in version 0.312.3.

An attacker can remotely bypass authentication on WebSocket subscription endpoints by exploiting the missing verification of the connection_init handshake. This allows unauthorized access to subscription data streams, potentially exposing sensitive information. The vulnerability does not impact integrity or availability but has a high confidentiality impact.

Upgrade Strawberry GraphQL to version 0.312.3 or later, where this authentication bypass vulnerability is fixed. Since this is a library vulnerability, ensure that all dependent applications update their Strawberry GraphQL dependency accordingly. Patch status is not explicitly stated in the vendor advisory, but the description confirms the issue is fixed in version 0.312.3.